CVE-2018-9856

Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request...

CVE-2018-9856: Cross-Site Request Forgery (CSRF)

Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request...

PT-2018-19078

Name of the Vulnerable Software and Affected Versions Kotti versions prior to 1.3.2 Kotti versions 2.x prior to 2.0.0b2 Description The issue concerns a CSRF problem in the local roles implementation. It can be triggered by a permission change via the "/admin-document/@@share" API endpoint...